@go-to-k/cdkd 0.103.0 → 0.103.2

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-CuHRHcyW.js";
-import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-DGKtcKF6.js";
+import { A as resolveApp, B as CdkdError, C as AssetPublisher, D as Synthesizer, E as buildDockerImage, F as warnDeprecatedNoPrefixCliFlag, G as PartialFailureError, I as AssemblyReader, J as ResourceUpdateNotSupportedError, K as ProvisioningError, M as resolveSkipPrefix, N as resolveStateBucketWithDefault, O as getDefaultStateBucketName, P as resolveStateBucketWithDefaultAndSource, R as resolveBucketRegion, S as shouldRetainResource, T as WorkGraph, U as LocalInvokeBuildError, X as StackHasActiveImportsError, Y as RouteDiscoveryError, Z as StackTerminationProtectionError, _ as DiffCalculator, a as withRetry, at as getLogger, b as LockManager, c as collectInlinePolicyNamesManagedBySiblings, ct as getLiveRenderer, d as normalizeAwsTagsToCfn, dt as generateResourceName, f as resolveExplicitPhysicalId, ft as generateResourceNameWithFallback, g as IntrinsicFunctionResolver, h as assertRegionMatch, i as withResourceDeadline, j as resolveCaptureObservedState, k as getLegacyStateBucketName, l as CDK_PATH_TAG, lt as PATTERN_B_NAME_PROPERTIES, m as CloudControlProvider, mt as withStackName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as normalizeAwsError, o as IMPLICIT_DELETE_DEPENDENCIES, p as ProviderRegistry, pt as withSkipPrefix, q as ResourceTimeoutError, r as DeployEngine, rt as withErrorHandling, s as IAMRoleProvider, st as runStackBuffered, t as DEFAULT_RESOURCE_TIMEOUT_MS, u as matchesCdkPath, ut as PATTERN_B_RESOURCE_TYPES, v as DagBuilder, w as stringifyValue, x as S3StateBackend, y as TemplateParser } from "./deploy-engine-D6nbHjNM.js";
 import { createHash, createPublicKey, createVerify, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagUserCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -30,14 +30,14 @@ import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCo
 import { promisify } from "node:util";
 import { CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$7, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$9 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { Command, Option } from "commander";
 import { writeFileSync as writeFileSync$1 } from "fs";
 import { join as join$1 } from "path";
 import * as zlib from "node:zlib";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$8, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$9, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$10, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBSubnetGroupCommand, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBSubnetGroupCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBSubnetGroupCommand, RDSClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$9, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$10, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$10, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$11, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-neptune";
 import { CreateWebACLCommand, DeleteWebACLCommand, GetWebACLCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ListWebACLsCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$11, UpdateWebACLCommand, WAFNonexistentItemException, WAFV2Client } from "@aws-sdk/client-wafv2";
@@ -15330,7 +15330,7 @@ var StepFunctionsProvider = class {
 			result["EncryptionConfiguration"] = ec;
 		}
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: physicalId }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: physicalId }))).tags);
 		} catch (err) {
 			if (!(err instanceof StateMachineDoesNotExist)) throw err;
 		}
@@ -15368,7 +15368,7 @@ var StepFunctionsProvider = class {
 			const list = await this.getClient().send(new ListStateMachinesCommand({ ...nextToken && { nextToken } }));
 			for (const sm of list.stateMachines ?? []) {
 				if (!sm.stateMachineArn) continue;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: sm.stateMachineArn }));
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: sm.stateMachineArn }));
 				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 					physicalId: sm.stateMachineArn,
 					attributes: {}
@@ -16304,7 +16304,7 @@ var ECSProvider = class {
 		do {
 			const list = await this.getClient().send(new ListClustersCommand({ ...nextToken && { nextToken } }));
 			for (const arn of list.clusterArns ?? []) {
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: arn }));
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ resourceArn: arn }));
 				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 					physicalId: arn.substring(arn.lastIndexOf("/") + 1),
 					attributes: {}
@@ -16331,7 +16331,7 @@ var ECSProvider = class {
 						...svcToken && { nextToken: svcToken }
 					}));
 					for (const svcArn of svcList.serviceArns ?? []) {
-						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$9({ resourceArn: svcArn }));
+						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$10({ resourceArn: svcArn }));
 						if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
 							physicalId: `${clusterArn}|${svcArn.substring(svcArn.lastIndexOf("/") + 1)}`,
 							attributes: {}
@@ -17660,7 +17660,7 @@ var RDSProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`RDS ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -17683,7 +17683,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBInstancesCommand({ ...marker && { Marker: marker } }));
 			for (const inst of list.DBInstances ?? []) {
 				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
 					physicalId: inst.DBInstanceIdentifier,
 					attributes: {}
 				};
@@ -17710,7 +17710,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBClustersCommand({ ...marker && { Marker: marker } }));
 			for (const c of list.DBClusters ?? []) {
 				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
 					physicalId: c.DBClusterIdentifier,
 					attributes: {}
 				};
@@ -17737,7 +17737,7 @@ var RDSProvider = class {
 			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ ...marker && { Marker: marker } }));
 			for (const sg of list.DBSubnetGroups ?? []) {
 				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
+				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
 					physicalId: sg.DBSubnetGroupName,
 					attributes: {}
 				};
@@ -17748,6 +17748,178 @@ var RDSProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/rds-dbproxy-targetgroup-provider.ts
+/**
+* AWS RDS DBProxyTargetGroup Provider
+*
+* Implements resource provisioning for `AWS::RDS::DBProxyTargetGroup`.
+*
+* **Why a dedicated SDK provider** (per `feedback_dedicated_provider_over_special_case.md`):
+* pre-PR this type went through Cloud Control API, but CC API's resource
+* handler for `AWS::RDS::DBProxyTargetGroup` fails the delete path with
+* `Value null at 'dBProxyName' failed to satisfy constraint`. The handler
+* cannot derive `DBProxyName` from the TargetGroup ARN (the primary
+* identifier), so the underlying RDS API call goes out with
+* `DBProxyName: null` and AWS rejects it (Issue #385).
+*
+* **What this resource actually does on AWS**: a CFn
+* `AWS::RDS::DBProxyTargetGroup` is a wiring resource — every DBProxy gets
+* a default TargetGroup (`TargetGroupName: 'default'`) auto-created by AWS;
+* the CFn resource only manages target REGISTRATIONS
+* (`RegisterDBProxyTargets` / `DeregisterDBProxyTargets`) and the
+* connection pool config (`ModifyDBProxyTargetGroup`). The TargetGroup
+* object itself is not deleted on resource delete — it lives and dies with
+* the parent DBProxy.
+*
+* **Lifecycle**:
+* - `create`: optionally `ModifyDBProxyTargetGroup` (connection pool), then
+*   `RegisterDBProxyTargets` (cluster IDs and / or instance IDs), then
+*   `DescribeDBProxyTargetGroups` to recover the TargetGroupArn for state.
+* - `update`: rejected via `ResourceUpdateNotSupportedError` in MVP. The
+*   per-property update surface (add/remove targets, pool config rewrites)
+*   is a follow-up.
+* - `delete`: `DeregisterDBProxyTargets` for every registered target.
+*   `DBProxyNotFoundFault` / `DBProxyTargetGroupNotFoundFault` /
+*   `DBProxyTargetNotFoundFault` are treated as idempotent success
+*   (region-match-gated) — the parent DBProxy may already have been
+*   deleted by a sibling cdkd delete or by AWS CASCADE.
+* - `getAttribute`: `TargetGroupArn` returns the physicalId; `TargetGroupName`
+*   returns `'default'`.
+*
+* **physicalId** = TargetGroupArn (matches the CFn `primaryIdentifier`).
+*/
+var RDSDBProxyTargetGroupProvider = class {
+	rdsClient;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("RDSDBProxyTargetGroupProvider");
+	handledProperties = new Map([["AWS::RDS::DBProxyTargetGroup", new Set([
+		"DBProxyName",
+		"TargetGroupName",
+		"DBClusterIdentifiers",
+		"DBInstanceIdentifiers",
+		"ConnectionPoolConfigurationInfo"
+	])]]);
+	getClient() {
+		if (!this.rdsClient) this.rdsClient = new RDSClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.rdsClient;
+	}
+	async create(logicalId, resourceType, properties) {
+		const dbProxyName = properties["DBProxyName"];
+		if (!dbProxyName) throw new ProvisioningError(`DBProxyName is required for AWS::RDS::DBProxyTargetGroup ${logicalId}`, resourceType, logicalId);
+		const targetGroupName = properties["TargetGroupName"] ?? "default";
+		const dbClusterIdentifiers = properties["DBClusterIdentifiers"];
+		const dbInstanceIdentifiers = properties["DBInstanceIdentifiers"];
+		const connectionPoolConfig = properties["ConnectionPoolConfigurationInfo"];
+		const client = this.getClient();
+		if (connectionPoolConfig) {
+			this.logger.debug(`Applying connection pool config to ${dbProxyName}/${targetGroupName}`);
+			try {
+				await client.send(new ModifyDBProxyTargetGroupCommand({
+					DBProxyName: dbProxyName,
+					TargetGroupName: targetGroupName,
+					ConnectionPoolConfig: connectionPoolConfig
+				}));
+			} catch (error) {
+				throw this.wrapError(error, "CREATE (pool config)", resourceType, logicalId, void 0);
+			}
+		}
+		if (dbClusterIdentifiers && dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers && dbInstanceIdentifiers.length > 0) {
+			this.logger.debug(`Registering targets for ${dbProxyName}/${targetGroupName}: clusters=[${dbClusterIdentifiers?.join(",") ?? ""}], instances=[${dbInstanceIdentifiers?.join(",") ?? ""}]`);
+			try {
+				await client.send(new RegisterDBProxyTargetsCommand({
+					DBProxyName: dbProxyName,
+					TargetGroupName: targetGroupName,
+					DBClusterIdentifiers: dbClusterIdentifiers,
+					DBInstanceIdentifiers: dbInstanceIdentifiers
+				}));
+			} catch (error) {
+				throw this.wrapError(error, "CREATE (register targets)", resourceType, logicalId, void 0);
+			}
+		}
+		let targetGroupArn;
+		try {
+			targetGroupArn = (await client.send(new DescribeDBProxyTargetGroupsCommand({
+				DBProxyName: dbProxyName,
+				TargetGroupName: targetGroupName
+			}))).TargetGroups?.[0]?.TargetGroupArn;
+		} catch (error) {
+			throw this.wrapError(error, "CREATE (describe)", resourceType, logicalId, void 0);
+		}
+		if (!targetGroupArn) throw new ProvisioningError(`Failed to recover TargetGroupArn for ${dbProxyName}/${targetGroupName} after create`, resourceType, logicalId);
+		return {
+			physicalId: targetGroupArn,
+			attributes: {
+				TargetGroupArn: targetGroupArn,
+				TargetGroupName: targetGroupName
+			}
+		};
+	}
+	async update(logicalId, _physicalId, resourceType, _oldProperties, _newProperties) {
+		throw new ResourceUpdateNotSupportedError(resourceType, logicalId, "destroy + redeploy; in-place updates of registered targets / connection pool config are not yet supported");
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const props = properties ?? {};
+		const dbProxyName = props["DBProxyName"];
+		const targetGroupName = props["TargetGroupName"] ?? "default";
+		const dbClusterIdentifiers = props["DBClusterIdentifiers"];
+		const dbInstanceIdentifiers = props["DBInstanceIdentifiers"];
+		if (!dbProxyName) throw new ProvisioningError(`DBProxyName missing from state.properties for AWS::RDS::DBProxyTargetGroup ${logicalId}; cannot deregister targets. Manually run: aws rds deregister-db-proxy-targets --db-proxy-name <proxy-name> --target-group-name ${targetGroupName} ...`, resourceType, logicalId, physicalId);
+		if (!(dbClusterIdentifiers && dbClusterIdentifiers.length > 0 || dbInstanceIdentifiers && dbInstanceIdentifiers.length > 0)) {
+			this.logger.debug(`No targets registered for ${dbProxyName}/${targetGroupName}; nothing to deregister`);
+			return;
+		}
+		this.logger.debug(`Deregistering targets from ${dbProxyName}/${targetGroupName}: clusters=[${dbClusterIdentifiers?.join(",") ?? ""}], instances=[${dbInstanceIdentifiers?.join(",") ?? ""}]`);
+		try {
+			await this.getClient().send(new DeregisterDBProxyTargetsCommand({
+				DBProxyName: dbProxyName,
+				TargetGroupName: targetGroupName,
+				DBClusterIdentifiers: dbClusterIdentifiers,
+				DBInstanceIdentifiers: dbInstanceIdentifiers
+			}));
+		} catch (error) {
+			if (error instanceof DBProxyNotFoundFault || error instanceof DBProxyTargetGroupNotFoundFault || error instanceof DBProxyTargetNotFoundFault) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`${dbProxyName}/${targetGroupName} or its target is already gone, treating as success`);
+				return;
+			}
+			throw this.wrapError(error, "DELETE", resourceType, logicalId, physicalId);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		switch (attributeName) {
+			case "TargetGroupArn": return physicalId;
+			case "TargetGroupName": return "default";
+			default:
+				this.logger.warn(`Unknown attribute ${attributeName} for AWS::RDS::DBProxyTargetGroup, returning undefined`);
+				return;
+		}
+	}
+	/**
+	* Adopt an existing DBProxyTargetGroup into cdkd state.
+	*
+	* **Explicit override only.** The TargetGroup itself has no tags
+	* (the parent DBProxy carries the cdkd path tag, not the wiring child),
+	* so there is no `aws:cdk:path`-based auto-lookup. Users must pass
+	* `--resource <logicalId>=<TargetGroupArn>`.
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) return {
+			physicalId: input.knownPhysicalId,
+			attributes: {
+				TargetGroupArn: input.knownPhysicalId,
+				TargetGroupName: "default"
+			}
+		};
+		return null;
+	}
+	wrapError(error, op, resourceType, logicalId, physicalId) {
+		const message = error instanceof Error ? error.message : String(error);
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`${op} failed for ${logicalId}: ${message}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
@@ -28473,6 +28645,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::RDS::DBSubnetGroup", rdsProvider);
 	registry.register("AWS::RDS::DBCluster", rdsProvider);
 	registry.register("AWS::RDS::DBInstance", rdsProvider);
+	registry.register("AWS::RDS::DBProxyTargetGroup", new RDSDBProxyTargetGroupProvider());
 	const docdbProvider = new DocDBProvider();
 	registry.register("AWS::DocDB::DBSubnetGroup", docdbProvider);
 	registry.register("AWS::DocDB::DBCluster", docdbProvider);
@@ -43452,7 +43625,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.103.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.103.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());